What is the best way to determine whether or not a file is an image in PHP?

Question

I have a sever which people can upload files to. The problem is that some of the filenames are mangled (dont have any extension) and so I cannot immediately determine file type.

Answer 1

You have two options here, one's simple and pre-built with some shortfalls, the other is complex and requires math.

PHP's fileinfo can be used to detect file types based on the file's actual header information. For instance, I just grabbed your gravitar:

But the actual code is this:

‰PNG


IHDR  szzô
IDATX…­—OL\UÆZÀhëT)¡    c•1T:1‘Š‘.Ú(]4†A“ÒEY˜à.................................

So, even without the file name I could detect it quite obviously. This is what the PHP Fileinfo extension will do. Most PNG and JPG files tend to have this header in them, but this is not so for every single file type.

That being said, fileinfo is dead simple to use, from the manual:

$fi = new finfo(FILEINFO_MIME,'/usr/share/file/magic');
$mime_type = $fi->buffer(file_get_contents($file));

Your other option is more complex and it depends on your own personal ambitions, you could generate a histogram and profile files based on their content.

Something like this looks like a GIF file:

And something like this looks like a TIFF file:

From there you'd need to generate a model over multiple types of files for what the histogram of each type should be, and then use that to guess. This is a good method to use for files that don't really have those "magic headers" that can be read easily. Keep in mind, you'll need to learn some math and how to model an average histogram function and match them against files.